SAA-C03 practice questions 191–200

1. Question 191 · 1017 in bank

   A solutions architect needs to design a system to store client case files. The files are core company assets and are important. The number of files will grow over time. The files must be simultaneously accessible from multiple application servers that run on Amazon EC2 instances. The solution must have built-in redundancy. Which solution meets these requirements?

   • AAmazon Elastic File System (Amazon EFS)
   • BAmazon Elastic Block Store (Amazon EBS)
   • CAmazon S3 Glacier Deep Archive
   • DAWS Backup

   Show answer

   Answer: A

   Explanation

   EFS provides a scalable and fully managed file storage service that can be accessed concurrently from multiple EC2. It offers built-in redundancy by storing data across multiple AZs within a region. With EFS, the client case files can be accessed by multiple application servers simultaneously, ensuring high availability and scalability as the number of files grows over time. Option B, EBS, is a block-level storage service that is typically used for attaching to individual EC2 and does not provide concurrent access to multiple instances, making it unsuitable for this scenario. Option C, S3 Glacier Deep Archive, is a long-term archival storage service and may not be suitable for active file access and simultaneous access from multiple application servers. Option D, AWS Backup, is a centralized backup management service and does not provide the required simultaneous file access and redundancy features. Therefore, the most suitable solution is Amazon EFS (option A).

   Source: Adapted from community discussion — cookieMr

   Next question

2. Question 192 · 1017 in bank

   A solutions architect has created two IAM policies: Policy1 and Policy2. Both policies are attached to an IAM group.

   

   

   A cloud engineer is added as an IAM user to the IAM group. Which action will the cloud engineer be able to perform?

   • ADeleting IAM users
   • BDeleting directories
   • CDeleting Amazon EC2 instances
   • DDeleting logs from Amazon CloudWatch Logs

   Show answer

   Answer: C

   Explanation

   ec2:* Allows full control of EC2 instances, so C is correct The policy only grants get and list permission on IAM users, so not A ds:Delete deny denies delete-directory, so not B, see https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ds/index.html The policy only grants get and describe permission on logs, so not D

   Source: Adapted from community discussion — JayBee65

   Next question

3. Question 193 · 1017 in bank

   A company is reviewing a recent migration of a three-tier application to a VPC. The security team discovers that the principle of least privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers. What should a solutions architect do to correct this issue?

   • ACreate security group rules using the instance ID as the source or destination.
   • BCreate security group rules using the security group ID as the source or destination.
   • CCreate security group rules using the VPC CIDR blocks as the source or destination.
   • DCreate security group rules using the subnet CIDR blocks as the source or destination.

   Show answer

   Answer: B

   Explanation

   B. Create security group rules using the security group ID as the source or destination. This way, the security team can ensure that the least privileged access is given to the application tiers by allowing only the necessary communication between the security groups. For example, the web tier security group should only allow incoming traffic from the load balancer security group and outgoing traffic to the application tier security group. This approach provides a more granular and secure way to control traffic between the different tiers of the application and also allows for easy modification of access if needed. It's also worth noting that it's good practice to minimize the number of open ports and protocols, and use security groups as a first line of defense, in addition to network access control lists (ACLs) to control traffic between subnets.

   Source: Adapted from community discussion — Aninina

   References

   • AWS documentation

   Next question

4. Question 194 · 1017 in bank

   A company has an ecommerce checkout workflow that writes an order to a database and calls a service to process the payment. Users are experiencing timeouts during the checkout process. When users resubmit the checkout form, multiple unique orders are created for the same desired transaction. How should a solutions architect refactor this workflow to prevent the creation of multiple orders?

   • AConfigure the web application to send an order message to Amazon Kinesis Data Firehose. Set the payment service to retrieve the message from Kinesis Data Firehose and process the order.
   • BCreate a rule in AWS CloudTrail to invoke an AWS Lambda function based on the logged application path request. Use Lambda to query the database, call the payment service, and pass in the order information.
   • CStore the order in the database. Send a message that includes the order number to Amazon Simple Notification Service (Amazon SNS). Set the payment service to poll Amazon SNS, retrieve the message, and process the order.
   • DStore the order in the database. Send a message that includes the order number to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the payment service to retrieve the message and process the order. Delete the message from the queue.

   Show answer

   Answer: D

   Explanation

   D. Store the order in the database. Send a message that includes the order number to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the payment service to retrieve the message and process the order. Delete the message from the queue. This approach ensures that the order creation and payment processing steps are separate and atomic. By sending the order information to an SQS FIFO queue, the payment service can process the order one at a time and in the order they were received. If the payment service is unable to process an order, it can be retried later, preventing the creation of multiple orders. The deletion of the message from the queue after it is processed will prevent the same message from being processed multiple times. It's worth noting that FIFO queues guarantee that messages are processed in the order they are received, and prevent duplicates.

   Source: Adapted from community discussion — Aninina

   Next question

5. Question 195 · 1017 in bank

   Select 2

   A solutions architect is implementing a document review application using an Amazon S3 bucket for storage. The solution must prevent accidental deletion of the documents and ensure that all versions of the documents are available. Users must be able to download, modify, and upload documents. Which combination of actions should be taken to meet these requirements? (Choose two.)

   • AEnable a read-only bucket ACL.
   • BEnable versioning on the bucket.
   • CAttach an IAM policy to the bucket.
   • DEnable MFA Delete on the bucket.
   • EEncrypt the bucket using AWS KMS.

   Show answer

   Answer: BD

   Explanation

   B. allows multiple versions of objects in the S3 bucket to be stored. This ensures that all versions of the documents are available, even if they are accidentally overwritten or deleted. D. adds an extra layer of protection against accidental deletion of objects in the bucket. With MFA Delete enabled, a user would need to provide an additional authentication factor to successfully delete objects from the bucket. This helps prevent accidental or unauthorized deletions and provides an extra level of security for critical documents. A. would restrict users from modifying or uploading documents. It would not meet the requirement of allowing users to download, modify, and upload documents. C. can control access permissions to the bucket, it does not specifically address the requirement of preventing accidental deletion or ensuring availability of all versions of the documents. E. Encryption focuses on data protection rather than versioning and deletion prevention.

   Source: Adapted from community discussion — cookieMr

   Next question

6. Question 196 · 1017 in bank

   A company is building a solution that will report Amazon EC2 Auto Scaling events across all the applications in an AWS account. The company needs to use a serverless solution to store the EC2 Auto Scaling status data in Amazon S3. The company then will use the data in Amazon S3 to provide near-real-time updates in a dashboard. The solution must not affect the speed of EC2 instance launches. How should the company move the data to Amazon S3 to meet these requirements?

   • AUse an Amazon CloudWatch metric stream to send the EC2 Auto Scaling status data to Amazon Kinesis Data Firehose. Store the data in Amazon S3.
   • BLaunch an Amazon EMR cluster to collect the EC2 Auto Scaling status data and send the data to Amazon Kinesis Data Firehose. Store the data in Amazon S3.
   • CCreate an Amazon EventBridge rule to invoke an AWS Lambda function on a schedule. Configure the Lambda function to send the EC2 Auto Scaling status data directly to Amazon S3.
   • DUse a bootstrap script during the launch of an EC2 instance to install Amazon Kinesis Agent. Configure Kinesis Agent to collect the EC2 Auto Scaling status data and send the data to Amazon Kinesis Data Firehose. Store the data in Amazon S3.

   Show answer

   Answer: A

   Explanation

   B - EMR cluster is for Big Data, has nothing to do with this C - invokes the function "on a schedule", but you want to capture events D - Could work, but would be overcomplex and would "affect the speed of EC2 instance launches" (which it should not)

   Source: Adapted from community discussion — pentium75

   References

   • AWS documentation

   Next question

7. Question 197 · 1017 in bank

   A company has an application that places hundreds of .csv files into an Amazon S3 bucket every hour. The files are 1 GB in size. Each time a file is uploaded, the company needs to convert the file to Apache Parquet format and place the output file into an S3 bucket. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an AWS Lambda function to download the .csv files, convert the files to Parquet format, and place the output files in an S3 bucket. Invoke the Lambda function for each S3 PUT event.
   • BCreate an Apache Spark job to read the .csv files, convert the files to Parquet format, and place the output files in an S3 bucket. Create an AWS Lambda function for each S3 PUT event to invoke the Spark job.
   • CCreate an AWS Glue table and an AWS Glue crawler for the S3 bucket where the application places the .csv files. Schedule an AWS Lambda function to periodically use Amazon Athena to query the AWS Glue table, convert the query results into Parquet format, and place the output files into an S3 bucket.
   • DCreate an AWS Glue extract, transform, and load (ETL) job to convert the .csv files to Parquet format and place the output files into an S3 bucket. Create an AWS Lambda function for each S3 PUT event to invoke the ETL job.

   Show answer

   Answer: D

   Explanation

   No, D should be correct. "LEAST operational overhead" => Should you fully manage service like Glue instead of manually like the answer A.

   Source: Adapted from community discussion — Parsons

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 198 · 1017 in bank

   A company is implementing new data retention policies for all databases that run on Amazon RDS DB instances. The company must retain daily backups for a minimum period of 2 years. The backups must be consistent and restorable. Which solution should a solutions architect recommend to meet these requirements?

   • ACreate a backup vault in AWS Backup to retain RDS backups. Create a new backup plan with a daily schedule and an expiration period of 2 years after creation. Assign the RDS DB instances to the backup plan.
   • BConfigure a backup window for the RDS DB instances for daily snapshots. Assign a snapshot retention policy of 2 years to each RDS DB instance. Use Amazon Data Lifecycle Manager (Amazon DLM) to schedule snapshot deletions.
   • CConfigure database transaction logs to be automatically backed up to Amazon CloudWatch Logs with an expiration period of 2 years.
   • DConfigure an AWS Database Migration Service (AWS DMS) replication task. Deploy a replication instance, and configure a change data capture (CDC) task to stream database changes to Amazon S3 as the target. Configure S3 Lifecycle policies to delete the snapshots after 2 years.

   Show answer

   Answer: A

   Explanation

   A. suggests using AWS Backup, a centralized backup management service, to retain RDS backups. A backup vault is created, and a backup plan is defined with a daily schedule and a 2-year retention period for backups. RDS DB instances are assigned to this backup plan. B. it does not address the requirement for consistent and restorable backups. Snapshots are point-in-time backups and may not provide the desired level of consistency. C. it is not designed to provide the backup and restore functionality required for databases. It does not ensure the backups are consistent or provide an easy restore mechanism. D. it does not address the requirement for daily backups and retention of consistent backups. It focuses more on replication and change data capture rather than backup and restore.

   Source: Adapted from community discussion — cookieMr

   Next question

9. Question 199 · 1017 in bank

   A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes. What should a solutions architect do to accomplish this goal?

   • ATurn on AWS Config with the appropriate rules.
   • BTurn on AWS Trusted Advisor with the appropriate checks.
   • CTurn on Amazon Inspector with the appropriate assessment template.
   • DTurn on Amazon S3 server access logging. Configure Amazon EventBridge (Amazon Cloud Watch Events).

   Show answer

   Answer: A

   Explanation

   The solution that will accomplish this goal is A: Turn on AWS Config with the appropriate rules. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. You can use AWS Config to monitor and record changes to the configuration of your Amazon S3 buckets. By turning on AWS Config and enabling the appropriate rules, you can ensure that your S3 buckets do not have unauthorized configuration changes.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 200 · 1017 in bank

    A company’s compliance team needs to move its file shares to AWS. The shares run on a Windows Server SMB file share. A self-managed on-premises Active Directory controls access to the files and folders. The company wants to use Amazon FSx for Windows File Server as part of the solution. The company must ensure that the on-premises Active Directory groups restrict access to the FSx for Windows File Server SMB compliance shares, folders, and files after the move to AWS. The company has created an FSx for Windows File Server file system. Which solution will meet these requirements?

    • ACreate an Active Directory Connector to connect to the Active Directory. Map the Active Directory groups to IAM groups to restrict access.
    • BAssign a tag with a Restrict tag key and a Compliance tag value. Map the Active Directory groups to IAM groups to restrict access.
    • CCreate an IAM service-linked role that is linked directly to FSx for Windows File Server to restrict access.
    • DJoin the file system to the Active Directory to restrict access.

    Show answer

    Answer: D

    Explanation

    D. Join the file system to the Active Directory to restrict access. Joining the FSx for Windows File Server file system to the on-premises Active Directory will allow the company to use the existing Active Directory groups to restrict access to the file shares, folders, and files after the move to AWS. This option allows the company to continue using their existing access controls and management structure, making the transition to AWS more seamless.

    Source: Adapted from community discussion — mhmt4438

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAA-C03 practice, question 191. 1017 questions available.